desfirecrypto.hpp

Go to the documentation of this file.

 
#ifndef DESFIRECRYPTO_HPP
#define DESFIRECRYPTO_HPP
 
#include <logicalaccess/plugins/cards/desfire/desfireaccessinfo.hpp>
#include <logicalaccess/plugins/crypto/des_cipher.hpp>
#include <logicalaccess/plugins/crypto/aes_cipher.hpp>
 
#include <memory>
#include <string>
#include <vector>
#include <iostream>
#include <string>
#include <logicalaccess/iks/RemoteCrypto.hpp>
 
namespace logicalaccess
{
typedef enum {
    CM_LEGACY = 0x00, // D40
    CM_ISO    = 0x01, // EV1
    CM_EV2    = 0x02  // EV2
} CryptoMethod;
 
// manage desfire crypto operation through iks.
struct IKSCryptoWrapper
{
    // IKS would generate a temporary key
    // after a proper Desfire authentication (through IKS).
    // Obviously key name is non-guessable and is unique per client / auth process
    std::string remote_key_name;
 
    // Simply the last signature received when we call aes_decrypt() through
    // and IKSRPCClient.
    SignatureResult last_sig;
};
 
class LLA_CARDS_DESFIRE_API DESFireCrypto
{
  public:
    DESFireCrypto();
 
    virtual ~DESFireCrypto();
 
    void appendDecipherData(const ByteVector &data);
 
    virtual ByteVector desfireDecrypt(size_t length);
 
    virtual bool verifyMAC(bool end, const ByteVector &data);
 
    virtual ByteVector generateMAC(unsigned char cmd, const ByteVector &data);
 
    virtual ByteVector desfireEncrypt(const ByteVector &data,
                                      const ByteVector &param = ByteVector(),
                                      bool calccrc            = true);
 
    ByteVector iso_encipherData(bool end, const ByteVector &data,
                                const ByteVector &param = ByteVector());
 
    static short desfire_crc16(const void *data, size_t dataLength);
 
    static uint32_t desfire_crc32(const void *data, size_t dataLength);
 
    static ByteVector desfire_CBC_send(const ByteVector &key, const ByteVector &iv,
                                       const ByteVector &data);
 
    static ByteVector desfire_CBC_receive(const ByteVector &key, const ByteVector &iv,
                                          const ByteVector &data);
 
    static ByteVector desfire_CBC_mac(const ByteVector &key, const ByteVector &iv,
                                      const ByteVector &data);
 
    static ByteVector sam_CBC_send(const ByteVector &key, const ByteVector &iv,
                                   const ByteVector &data);
 
    static ByteVector desfire_mac(const ByteVector &key, ByteVector data);
 
    static ByteVector desfire_encrypt(const ByteVector &key, ByteVector data,
                                      bool calccrc = true);
 
    ByteVector
    desfire_iso_encrypt(const ByteVector &key, const ByteVector &data,
                        std::shared_ptr<openssl::OpenSSLSymmetricCipher> cipher, const ByteVector &param = ByteVector(),
                        bool calccrc = true);
 
    static ByteVector sam_encrypt(const ByteVector &key, ByteVector data);
 
    static ByteVector desfire_decrypt(const ByteVector &key, const ByteVector &data,
                                      size_t datalen);
 
    ByteVector
    desfire_iso_decrypt(const ByteVector &key, const ByteVector &data,
                        std::shared_ptr<openssl::OpenSSLSymmetricCipher> cipher, size_t datalen);
 
    ByteVector desfire_iso_decrypt(const ByteVector &data, size_t length);
 
    ByteVector desfire_cmac(const ByteVector &key,
                            std::shared_ptr<openssl::OpenSSLSymmetricCipher> cipherMAC, const ByteVector &data);
 
    ByteVector desfire_cmac(const ByteVector &data);
 
    virtual ByteVector authenticate_PICC1(unsigned char keyno, ByteVector diversify,
                                          const ByteVector &encRndB);
 
    virtual void authenticate_PICC2(unsigned char keyno, const ByteVector &encRndA);
 
    ByteVector iso_authenticate_PICC1(unsigned char keyno, ByteVector diversify,
                                      const ByteVector &encRndB, unsigned int randomlen);
 
    void iso_authenticate_PICC2(unsigned char keyno, const ByteVector &encRndA1,
                                unsigned int randomlen);
 
    ByteVector aes_authenticate_PICC1(unsigned char keyno, ByteVector diversify,
                                      const ByteVector &encRndB);
 
    ByteVector aes_authenticate_PICC1_GENERIC(unsigned char keyno,
                                              const std::shared_ptr<Key> &key,
                                              const ByteVector &encRndB);
 
    void aes_authenticate_PICC2(unsigned char keyno, const ByteVector &encRndA1);
 
    void aes_authenticate_PICC2_GENERIC(unsigned char keyno,
                                        const std::shared_ptr<Key> &key,
                                        const ByteVector &encRndA1);
 
    void initBuf();
 
    static void getKey(std::shared_ptr<DESFireKey> key, ByteVector diversify,
                       ByteVector &keydiv);
 
    static void getKeyVersioned(std::shared_ptr<DESFireKey> key,
                                ByteVector &keyversioned);
 
    void selectApplication(size_t aid);
 
    virtual ByteVector changeKey_PICC(uint8_t keyno, ByteVector oldKeyDiversify,
                                      std::shared_ptr<DESFireKey> newkey,
                                      ByteVector newKeyDiversify,
                                      unsigned char keysetno = 0);
 
    void setCryptoContext(ByteVector identifier);
 
    void createApplication(int aid, uint8_t maxKeySlotNb, uint8_t maxNbKeys,
                           DESFireKeyType cryptoMethod);
 
    void setIdentifier(ByteVector identifier)
    {
        d_identifier = identifier;
    }
 
    ByteVector getIdentifier() const
    {
        return d_identifier;
    }
 
    static std::shared_ptr<DESFireKey> getDefaultKey(DESFireKeyType keyType);
 
    virtual void setDefaultKeysAt(std::shared_ptr<Location> location);
 
    virtual void setKey(size_t aid, uint8_t keyslot, uint8_t keyno,
                        std::shared_ptr<DESFireKey> key);
 
    virtual void setKeyInAllKeySet(size_t aid, uint8_t keySlotNb, uint8_t nbKeys,
                                   std::shared_ptr<DESFireKey> key);
 
    virtual void clearKeys();
 
    std::shared_ptr<DESFireKey> getKey(uint8_t keyslot, uint8_t keyno) const;
 
  protected:
    bool getKey(size_t aid, uint8_t keyset, uint8_t keyno, ByteVector diversify,
                ByteVector &keydiv);
 
    bool getKey(uint8_t keyset, uint8_t keyno, ByteVector diversify, ByteVector &keydiv);
 
    std::shared_ptr<DESFireKey> getKey(size_t aid, uint8_t keyslot, uint8_t keyno) const;
 
    std::map<std::tuple<size_t, uint8_t, uint8_t>, std::shared_ptr<DESFireKey>> d_keys;
 
  public:
    CryptoMethod d_auth_method;
 
    std::shared_ptr<openssl::OpenSSLSymmetricCipher> d_cipher;
 
    unsigned int d_mac_size;
 
    ByteVector d_sessionKey;
 
    ByteVector d_authkey;
 
    ByteVector d_lastIV;
 
    unsigned int d_currentAid;
 
    unsigned char d_currentKeyNo;
 
#ifndef SWIG
    // If present it means we use IKS...
    std::unique_ptr<IKSCryptoWrapper> iks_wrapper_;
#endif
 
    SignatureResult get_last_signature() const;
 
  protected:
    ByteVector d_buf;
 
    ByteVector d_last_left;
 
    ByteVector d_rndA;
 
    ByteVector d_rndB;
 
    ByteVector d_identifier;
};
}
 
#endif /* DESFIRECRYPTO_HPP */